LLMNR/NBT-NS Poisoning and Relay is an attack that tricks hosts into sending authentication requests to the attacker by answering local name-resolution queries. The captured credentials or challenge-response material can then be relayed to other services. Defenders disable the protocols where possible and require protections such as signing and strong authentication.
How LLMNR and NBT-NS poisoning works
LLMNR and NBT-NS are fallback name-resolution protocols, so they become useful to attackers when a host cannot resolve a name through normal infrastructure and broadcasts the query locally. Poisoning works by answering that query first, which can redirect the victim toward an attacker-controlled listener.
This matters because the protocol design assumes local trust and speed, not strong origin validation. In mixed or poorly hardened Windows environments, that gives an attacker a simple way to turn ordinary name lookup into a credential capture opportunity.
Why relay makes the attack more dangerous
Poisoning alone is often only the first step. The real danger appears when the attacker relays the captured authentication exchange to another service that accepts it, turning one mistaken request into access to something more valuable.
That is why this technique is usually discussed together with ntlm relay and other downstream abuse paths. The attacker does not necessarily need to crack the material they collect if the target service will accept a forwarded authentication attempt.
Where exposure comes from in real environments
Exposure usually exists wherever hosts still fall back to LLMNR or NBT-NS, where name resolution is unreliable, or where workstations can reach services that accept weaker authentication paths. Flat networks, legacy systems, and permissive segmentation make the technique easier to use at scale.
Network Ports and Protocols Security Guide is useful background because it places LLMNR and NetBIOS-related protocol exposure in the broader context of insecure or legacy network services. Lateral Movement Guide then shows how poisoned authentication traffic can become a practical path into SMB relay and follow-on movement.
How defenders reduce and detect the abuse
The defensive pattern is straightforward: remove the fallback protocols where possible, force stronger authentication protections on services that matter, and reduce the number of reachable targets that can be abused through relay. Signing requirements and hardened authentication settings make relayed material far less useful.
Detection usually depends on seeing the poison-and-relay chain rather than the query alone. Suspicious local name-resolution replies, unexpected authentication attempts against internal services, and repeated failed or odd authentication patterns can all indicate that the environment is being probed or actively abused.
Lateral Movement Guide is especially relevant here because it ties the technique to SMB relay, detection content and hardening actions. For broader hardening logic, NIST Cybersecurity Framework 2.0 supports the same lifecycle view, identify the exposure, protect the protocol path, detect unusual authentication activity, and respond quickly when misuse appears.
Risk and Threat Considerations
This technique is risky because it converts a low-friction local broadcast into a trust abuse event. Once a host responds, the attacker may capture authentication material that can be reused, relayed, or combined with other weaknesses to reach systems the victim never intended to talk to.
Failure mechanism: The environment permits fallback name resolution and accepts authentication paths that can be relayed without strong channel binding, signing, or equivalent protections.
Impact: Attackers can capture or forward authentication material, gain unauthorized access to internal services, and use that access to support lateral movement or privilege escalation.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1557 — Adversary-in-the-Middle | Covers poisoning and relay as an adversary-in-the-middle technique. |
| Recommendation — Map observed poisoning and relay activity to T1557 and hunt for local name-resolution abuse. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | Strong auth and access enforcement reduce the value of relayed authentication material. |
| DE.CM-01 — Networks and network services are monitored to find anomalies and events | Detection depends on monitoring anomalous authentication and name-resolution behavior. | |
| PR.DS-01 — Data-at-rest is protected | Credential material and supporting secrets should be protected from exposure and reuse. | |
| Recommendation — Enforce PR.AA-05 to require strong authentication and limit relayable access paths. Use DE.CM-01 to monitor for suspicious name-resolution and authentication patterns. Apply PR.DS-01 to protect sensitive credential material that could be reused after interception. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Limits and removes unnecessary access paths that relay attacks try to exploit. |
| Recommendation — Use CIS-6 to reduce reachable services and tighten access paths that can be relayed. | ||
Practitioner Guidance
Why practitioners should care: This is one of the few attacks that can begin with a simple local query and still end in meaningful access, so it belongs in both hardening and detection baselines. The most effective control is to eliminate the conditions that let a poisoned reply become a valid authentication path.
What to watch for: Treat repeated name-resolution chatter, suspicious responder-like behavior, and authentication attempts that arrive from an unexpected source as a sign that the environment may be vulnerable or under active testing.
Practitioner takeaway: If LLMNR or NBT-NS is still enabled, assume the attack surface is larger than it looks and verify that the services most likely to be relayed are also the ones with the strongest signing and authentication protections.